Don't ship a personal profile; pin the Worker to the Pages origin

The repo is public and deployed now, so two things needed tightening:

- index.html: DEFAULT_PROFILE is empty instead of a Steam vanity name. The
  page no longer tries to sync somebody else's account on first load, and
  no personal handle ships in the repo. Anyone running it locally keeps
  their profile in localStorage, so existing local use is unaffected.
- steam-proxy-worker.js: ALLOW_ORIGIN pinned to
  https://rain.pages.melonbread.xyz rather than '*', so only the deployed
  page can call the Worker if it is ever deployed.
- README: record the deployment URL and use a neutral example vanity name.

index.html

@@ -486,8 +486,10 @@ const BIGBOSS      = {"intro":"Three hours, no rations, no kills, no radar, no s
    STATE
    ============================================================ */
 const KEY = 'mgs2mc-guide-v1';
-/* Pre-filled so the page syncs itself on first load. Clear it with "Forget profile". */
-const DEFAULT_PROFILE = 'mrmelonbread';
+/* Optional: a Steam vanity name or SteamID64 to sync on first load.
+   Left empty in the public repo - type your own on the Steam Sync tab instead.
+   (Anyone still running a local copy keeps their saved profile in localStorage.) */
+const DEFAULT_PROFILE = '';
 /* Live Steam sync needs a server (Steam sends no CORS headers). Leave this empty when running
    locally next to steam-sync.py. If you host this page on GitHub Pages / Netlify / Cloudflare,
    deploy steam-proxy-worker.js and paste its URL here to get sync back. */